Category Archives: Potential Risk of CVE

Cisco Firepower vulnerabilities – Apr 2018

The content filter features enhance the firewall defense function. At the same time it is hard to avoid the design limitation occurs in this place. And therefore vulnerabilities occurs!

Vulnerabilities  details shown as below:







The next page of cyber attack – After European allies did the justice action (bombard Syria chemical facilities).


I can’t hold the tears back!

Rest in peace to victims who were killed in a suspected chemical attack on the rebel-held town of Khan Sheikhoun in north-western Syria on 4 April, 2018.

 International Law

About Convention on the Prohibition of the Development, Production, Stockpiling and Use of Chemical Weapons and on their Destruction

Reference :

  • Australia Group of countries and the European Commission that helps member nations identify exports which need to be controlled so as not to contribute to the spread of chemical and biological weapons
  • 1990 US-Soviet Arms Control Agreement
  • General-purpose criterion, a concept in international law that broadly governs international agreements with respect to chemical weapons
  • Geneva Protocol, a treaty prohibiting the first use of chemical and biological weapons


United state of America is the leader keen to fight against of the evils. As a result their country possibly will be receive high volume of cyber attack after completed the justice military action.

UK a member of the alliance. As a result the situation will be similar.

Predict the target (Healthcare and clinic)

Per observation so far, the ransomware activities are wreak havoc in between 2017 to present. Retrospective that the UK healthcare and clinical areas suffered such attack last  year.  Below table of chart showing the (Ransomware) attack vector to specific industry.

In additional of UK joined the military action. The terrorist will spend the efford to find out the weakness of the healtcare system infrastructre. In logic point of view the healthcare and clinic will become the attack target because the terrorist will buy out the details from the criminal group. As a result a complete understanding of the design weakness on those area. Whereby it have high possibilities to engage the 2nd round of attack similar a revenge action.

Earlier last week an article issued by US-CERT with subject. Protecting Your Networks from Ransomware. Their aim is going to provide a guidance to fight against ransomware. Before you read the articles. There are few slogans are able to enhance your data protection framework. For instance:

1. Ransomware and Phishing Work Together

2. For whom who visiting online Gaming zone and Pornography web site in frequent are easy for encounter ransomware attack.

In order to avoid similar of cyber attack, enhance your awareness is the first priority. For more details, please refer below url for reference.

Protecting Your Networks from Ransomware

Predict the target – Pathway (router and network switch)

Since the market share of Cisco in both network switch and router are in big portion (see below diagram)

From technical point of view,  it is not easy to identify the product design in perfect way in modern technology business market. And therefore the threat actors will be make use of vulnerabilities to engage the cyber attack. In regards to the view point of security expert , hacker now keen to compromise the network switch nowadays. As a matter of fact hacker will prefer to compromise a hardware switch or router because he can control the traffic and retrieve the information. So the Cisco end users must be stay alert of security update announce by Cisco in this period of time. Below informative diagram will provides hints to you in this regards.

Cisco IOS is a monolithic operating system running directly on the hardware while IOS XE is a combination of a linux kernel and a (monolithic) application (IOSd) that runs on top of this kernel. Attacker executing code remotely using system vulnerabilities. It is common type of attack and hard to avoid.

Perhaps a medium vulnerability found on IT product not a shock. However the medium vulnerability co-exists with known critical vulnerabilities created multiple vulnerabilities are unable to foreseen what is the level of damage. Cisco IOS XE fundamental design integrate to open system. The severity of vulnerability CVE-2018-0196 is medium level. End user is allow to disable the http services to avoid the vulnerability. But the default state of the HTTP Server feature is version-dependent. A significant signal alert Cisco customer that corrective control is not enough. The efficient way is enhance your preventive and detective control. That is the implementation of managed security services.

The design objective of the Command Line Parser is used to parse the command line arguments. The parser parsing a string and returns an object representing the values extracted. This is the the regular expression design objective. The Cisco IOS XE is a train of Cisco Systems’ widely deployed Internetworking Operating System (IOS), introduced with the ASR 1000 series. IOS XE is a combination of a linux kernel and a (monolithic) application (IOSd) that runs on top of this kernel. The goal of IOS SE aim to integrate the IOS feature set for routing and switching cope with modern business critical applications. The CLI command injection vulnerability has been found on CISCO IOS XE. Stay alert.

US-cert encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates. For more details, please see below:

Predict the target – Electricity power facility, water supply and Gas supply facilities

SCADA system are popular and pay a major role in modern industrial automation including manufacturing production control, building facilities electricity devices control, etc. I believe that these areas do not lure the hacker interest. As usual, threat actors will remain unchanged focusing in the following critical public faciliteis.

Electricity power facility, water supply and Gas supply facilities.

In regards to vendor announcement last few month. The popular brand name of SCADA major supplier has vulnerabilities occured. Perhaps the SCADA owner applied the patch and completed the remediation. However the SCADA kernel more relies on Microsoft product based operating system. So we must consider is there any new security announcement by vendor. Below details are the vulnerabilities encountered last few months.

Allen Bradley – The design flaw of the programmable logic controller – system vulnerability

Oil refinery industry security alert! CVE-2018-4841

SCADA manufacturer security awareness awaken – ABB

Vulnerability in SCADA CODESYS Web Server CVE-2018-5440

Predict the target – logistic delivery (marine)

Hacker might interrupt the maritime bandwidth management system relies on vulnerabilities if it did not complete the patch. The specify vulnerability causes shipping traffic jam or suspend the logistic delivery. Whereby the marine industry especially container shipping company must stayed alert.

Navarino Infinity web interface is affected by multiple vulnerabilities

About situation of France

France under terrorist attack in frequent. The terrorist attack on 2017 are happened 8 times. The most recent of attack causes 5 people dead. Perhaps there is less hit rate of cyber attack shown on top of newspaper. Even though the overall situation is unkown. However the similar cirtical level of cyber attack will be happened in that place.

At the end, I wishing that justice will be win the battle. “In God We Trust“.

— End —

Stay alert! Cisco Releases Security Updates for Multiple Products 18th April 2018

Be extra alert because alliance bombarded Syria chemical facilities with justice. So the cyber attacks will be increased. I encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates. For more details, please see below:

Cisco WebEx Clients Remote Code Execution Vulnerability cisco-sa-20180418-wbs (link is external) –

Cisco UCS Director Virtual Machine Information Disclosure Vulnerability for End User Portal cisco-sa-20180418-uscd (link is external) –

Cisco StarOS Interface Forwarding Denial of Service Vulnerability cisco-sa-20180418-staros (link is external) –

Cisco IOS XR Software UDP Broadcast Forwarding Denial of Service Vulnerability cisco-sa-20180418-iosxr (link is external) –

Cisco Firepower Detection Engine Secure Sockets Layer Denial of Service Vulnerability cisco-sa-20180418-fpsnort (link is external) –

Cisco Firepower 2100 Series Security Appliances IP Fragmentation Denial of Service Vulnerability cisco-sa-20180418-fp2100 (link is external) –

Cisco ASA Software, FTD Software, and AnyConnect Secure Mobility Client SAML Authentication Session Fixation Vulnerability cisco-sa-20180418-asaanyconnect (link is external) –

Cisco Adaptive Security Appliance Application Layer Protocol Inspection Denial of Service Vulnerabilities cisco-sa-20180418-asa_inspect (link is external) –

Cisco Adaptive Security Appliance TLS Denial of Service Vulnerability cisco-sa-20180418-asa3 (link is external) –

Cisco Adaptive Security Appliance Flow Creation Denial of Service Vulnerability cisco-sa-20180418-asa2 (link is external) –

Cisco Adaptive Security Appliance Virtual Private Network SSL Client Certificate Bypass Vulnerability cisco-sa-20180418-asa1 (link is external) –


Oracle security update for April 2018 to address 254 vulnerabilities across multiple products

We heard tsunami so far, but it is hard to imagine that it will be happened in IT world.

Oracle has released its Critical Patch Update for April 2018 to address 254 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. A technology type of tsunami happened today which given by Oracle!

Next Critical Patch Update Schedule

  • 17 July 2018
  • 16 October 2018
  • 15 January 2019
  • 16 April 2019

No comment in this regard! Crazy! For more detail, please refer below url for reference.

About Apple security updates – CVE-2018-4173 – It allows invisible microphone access via a crafted app

We do not have suprise that malware infiltrate malicious code to software application because it happens in frequent from cyber technology world.  Apple counputer found a vulnerability on their iOS and MacOS was that a invisible microphone access via a crafted app but do not display on status bar. But it bring up the concerns, details are shown as below:

  1. Apple code scanning do well. But how does hacker do this implant or embedded malicous code in SDK?
  2. Even though someone turn on microphone on iphone, but the problem is that it do not shown on status bar?

About Apple security updates

About the security content of iOS 11.3

About the security content of macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El Capitan



Be patient! KB4100375. Stay tuned!

If the memory leak is intensive, it can cause the program to crash or even make the whole computer freeze. The most common reason programs have memory leaks is due to a programming error where unused memory is not allocated back to the system.Memory leaks are a class of bugs where the application fails to release memory when no longer needed. A large leak might result in unacceptable response times due to excessive paging. The windows 10  security update (KB4100375) rescheduled because of above reasons.

For more details, please refer below url for reference.

Microsoft explains why Windows 10 Spring Creators Update delayed

Company which are going to implement the opensource CMS system, you must be extra care – Apr 2018.

Using a CMS, companies can easily build sites for themselves and their clients. These systems streamline web design and content publishing, ensuring that both your site and workflow are streamlined.The open source CMS system (Drupal, Joomla, Magento and CMS Made Simple) boost up the market growth and demand. However EU is going to enforce the law on data protection and privacy for all individuals within the European Union. Just do a quick review of the vulnerabiolties found on open source this year (2018). Those vulnerabilities happened are potentially contravention of the data protect law. So company which are going to implement the opensource CMS system, you must be extra care.

Opensources CMS system vulnerability Reference –

Drupal core – Highly critical – Remote Code Execution (Mar 2018)

VMware Releases Security Updates – especially cloud base users must staying alert! 12th Apr 2018

In java world, it has plenty of areas are allow hacker to do some tricks. VMware announced that found so called DOM Based Cross-site Scripting Vulnerability and Missing renewal of session tokens vulnerability. In regards to my comment, both vulnerabilities similar modern java applications security weakness, we are able to apply filter to do that. For example a regular expression solution. In short, please refer official announcement for reference.

vRealize Automation updates address multiple security issues

Juniper JunOS – The giant is sick! April 2018

Kernel crash upon receipt of crafted CLNP packets (CVE-2018-0016)

Denial-of-service vulnerability in flowd daemon on devices configured with NAT-PT (CVE-2018-0017)

Crafted packet may lead to information disclosure and firewall rule bypass during compilation of IDP policies (CVE-2018-0018)

Denial-of-service vulnerability in SNMP MIB-II subagent daemon (mib2d) (CVE-2018-0019)

rpd daemon cores due to malformed BGP UPDATE packet (CVE-2018-0020)

Eclipse Jetty information disclosure vulnerability (CVE-2015-2080)

Return of Bleichenbacher’s Oracle Threat (ROBOT) RSA SSL attack (CVE-2017-1000385)

Multiple vulnerabilities resolved in OpenSSL

Multiple vulnerabilities in stunnel 5.38


Multiple vulnerabilities resolved in CentOS 6.5-based 2012.2R12 release


Short MacSec keys may allow man-in-the-middle attacks

Mbuf leak due to processing MPLS packets in VPLS networks (CVE-2018-0022)

world writeable default configuration file permission (CVE-2018-0023)



Microsoft security update – April 10, 2018 – KB4093112

The security update of Microsoft this week included provides support to control usage of Indirect Branch Prediction Barrier (IBPB) within some AMD processors (CPUs) for mitigating CVE-2017-5715. Apart from that it also provides Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities. However I was wondering the mitigation plan coverage provided by AMD?

A insidiousness of the SIMD instruction extensions of ARM, MIPS, and x86? Does AMD cover this part because SIMD Instructions considered harmful?Any advice or we just ignore it?

For more details about the security update, please refer below url for references.

Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities –

KB4093112 –